Bounding the Sum of Square Roots via Lattice 

Reduction * 



Qi Cheng-'^ and Xianmeng Meng^ and Celi Sun^ and Jiazhe Chen^ 

^ School of Computer Science 
The University of Oklahoma 
Norman, OK 73019, USA. 
Email: {qcheng, sclj@cs.ou.edu. 
^ Lab of Cryptographic Technology and Information Security 
Shandong University 
Jinan 250100, P.R. China. 



Abstract. Let k and n be positive integers. Define R{n, k) to be the 
minimum positive value of 

\et^/s^ + e2^/s^ A + ek^/sk - t\ 

where si,S2, - ■ ■ ,Sk are positive integers no larger than n, t is an integer 
and Ci G {1,0,-1} for all 1 < i < fe. It is important in computational 
geometry to determine a good lower and upper bound of R{n, k). In this 
paper we show that this problem is closely related to the shortest vector 
problem in certain integral lattices and present an algorithm to find lower 
bounds based on lattice reduction algorithms. Although we can only 
prove an exponential time upper bound for the algorithm, it is efficient 
for large k when an exhaustive search for the minimum value is clearly 
infeasible. It produces lower bounds much better than the root separation 
technique does. Based on numerical data, we formulate a conjecture on 
the length of the shortest nonzero vector in the lattice, whose validation 
implies that our algorithm runs in polynomial time and the problem of 
comparing two sums of square roots of small integers can be solved in 
polynomial time. As a side result, we obtain constructive upper bounds 
for R{n, k) when n is much smaller than 2^*^. 



1 Introduction 



Comparing sums of square roots of integers is a famous open problem in compu- 
tational geometry and numerical analysis. It arises when we need to compare the 
length of two polygonal paths in a Euclidean space. The problem takes another 
form when one compares a sum of square roots with an integer. This problem is 
not known to be in NP. In fact, PSPACE is the smallest well studied complex- 
ity class that provably contains this problem |11| . In practice, however, it can 
usually be solved quickly. 
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Definition 1. Define ri(n,k) to be the minimum positive value of 



1 + ^ y/S[k/2i~ y/S[k/2i+l 



where Si, S2, • • ■ , Sfc are positive integers less than or equal to n. Define r2{n, k) 
to be the minimum positive value of 



'32 ■ 



where si,S2,-- - , Sfe are positive integers less than or equal to n and t is an 
integer. Define R(n, k) to be the minimum positive value of 

|eiVsi + e2\/s2 H K Sky^ ~ t\ 

where si, S2, ■ ■ ■ , Sfe are positive integers no larger than n, t is an integer and 
e, e {1, 0, -1} for alll<i<k. 



For example, we have that 
ri(3,3) = 



0.268, 



and 



r2(3,3) = 



i?(3,3) 



\/3 + V2 + VT-4 



V2 + V2- V3-1 



0.146 



0.096. 



It is easy to see that R{n,k) < ri{n,k) and R{n,k) < r2{n,k). Since we are 
mainly interested in the lower bounds, we shall be concentrating on R{n, k). If 
one can show that R{n, k) > l/2P°'y^'"''°s")^ then comparing the sum of k square 
roots of integers no larger than n can be done in time polynomial in k and logn. 

The problem of sum of square roots has recently attracted attention. First 
it is the main barrier to accurately classify some of the most fundamental com- 
putational problems in Euclidean space, such as the shortest path problem, the 
minimum spanning tree problem and the traveling salesman problem [5]. Sec- 
ondly it is the simplest among the problems of the sign determination of algebraic 
numbers of high degree. Thirdly it has been used to show hardness of problems 
in other area such as approximation of 3-player Nash equilibrium 4^. 



1.1 Previous work 

The zeroes of 

f{si, ■■■ , Sfc) = y/s^+y/s^-\ y- y/Slk/2l - \/*L't/2j+l V^k 

form a surface in 'R.^, where Si is nonnegative for 1 < i < k.To bound ri (n, k) we 
consider an equivalent problem: how near to the surface can an integral point of 
absolute height no larger than n get and still miss? In general finding a near-miss 
integral point to a surface is a very hard problem. Elkies [3] presented algorithms 



for these kind of problems with time complexity better than an exhaustive search. 
As an example, he showed how to find integral points near the curve — y^ = 0. 
It seems hard to generalize his algorithm to the sum of square roots problem as 
the dimension is much higher. 

The known lower bound comes from the root separation technique (for in- 
stance see j2] and [1]), which shows that 

ri(n, k) > max 

where 7r(n) is the number of primes no larger than n, and 

R{n, k) > max 

For example, it gives 



i?(165,100) > (200\/l65 



10" 



-468635490828 



(1) 



The lower bound is too small when k and n are large. However no significantly 
better lower bound has been reported as far as we are aware. 

Qian and Wang [S] presented an upper bound for ri(n, fc) based on the in- 
equality: 



< 



1 * 3 * 5 * • • • * {2k — 3) 



Note that (^) can be as large as (^,^2) ^ 2^/k. For any fixed positive integer k, 
taking 



n = 2^''t > max 

0<j<A: V I 



(t + i), 



(2) 



we have 



ri(n, k) < 



E(-i) 



(t+i) 



< 



1 * 3 * 5 * • • • * {2k — 3) * 2 



2fe^-2fc 



{2^H)''- 



where Cfc = 1 * 3 {2k — 3) * 2^*^ is a constant depending only on k. By 

([2]), we have that Qian and Wang's result only applies when n is much greater 
than 2^'^. In particular it does not give a meaningful bound when k = 100 and 
n < 2200 w 10^0. 



1.2 Our results 



We present a method to numerically bound R{n, k) from below based on lattice 
reduction. Our method is efficient for large k and n such as fc = 100 and n = 165, 
where an exhaustive search is clearly infeasible. The lower bounds we obtain are 
much better than the root separation bound. See Table [T] that compares our 
lower bounds with that of the root separation technique. 

Table 1. Comparing our lower bounds with those of the root separation tech- 
nique 



R{n,k) 


Root Separation Technique 
Lower Bound 


Lattice Reduction Technique 
Lower Bound 


i?(15, 10) 




10-^" 


R{33, 20) 


^0-2418 


^0-50 


R{47, 30) 


-|^Q-42832 


^0-80 


i?(66,40) 


2Q-368688 


10-120 


7?(82,50) 


■|^Q-6201084 


lQ-155 


7?(97, 60) 


■|^g-51549123 


lQ-195 


i?(113, 70) 


j^Q- 1703312763 


10-240 


i?(131,80) 


j^Q-7006714363 


10-290 


i?(146,90) 


-|^g-28668468036 


10-335 


i?(165, 100) 


■|^Q-468635490828 


10-390 



Define [x] = [x + 1/2J and {x} — x — [x]. We call an integer b square-free if 
there does not exist an integer a > 1 such that a^|6. We denote the i-th square 
free integer starting from 2 by cr(i). It is known that the square roots of distinct 
square-free integers are linearly independent over Q and a{i) satisfies (see [8]) 

a{i) =Tr^i/6 + 0{Vi). (3) 

Let si, S2, ■ ■ ■ 5 •Sfe be the distinct square-free integers no smaller than 2. Let 
A'^ be a positive integer. Our method is based on studying the integral lattice 
generated by the following k + 1 vectors in R'^+^j 

vo = (iV,0,0,0,-- - ,0) 
vi = ([7VVir],l,0,0,--- ,0) 
V2 = {[N^,0,1,0,--- ,0,) 
V3 = ([AfV^,0,0,l,--- ,0,) 

vfe = ([7Vyi^,0,0,0,-- - ,1). 

We denote the lattice by Lsi^s2,--- ,Sk{N)- If si = 2, S2 = 3, • • • , = a{k) are 
the consecutive square free integers, we will simply use £(fc, A^) to denote the 
lattice. 



In this paper, we are mainly concerned with R{a{k), fc), since a good lower 
bound on R{a{k),k) can imply a good lower bound on R(n,k) whenever n = 
fcO(i). 

Lemma 1. If R{a(k),k) > 1/2?°^'=), then R{n,k) > l/2P°iy(»fc). 

Proof. If n < cr(fc), then i?(n, k) > R{a{k), k). If n > <j{k), by ([3]), there exists 
k' = lonj-K^ + 0(V") such that cr(fc') < n < cr(A:' + 1), then 

i?(n,fc) > R{a{k'),k') = 1/2?°^"*^). 

The following theorem relates the shortest vector of L{k, N) to a lower bound 
oi R{(j{k),k). 

Theorem 1. // there is a positive integer N such that the shortest nonzero 
vector in L{k, N) has length greater than y^(l + k^Ja{k) /2)'^ + k^a{k), then 

R{a{k),k) > l/N. 

We can also obtain constructive upper bounds from the following theorem. 

Theorem 2. Let (s, ai, 02, • ■ ■ , Ok) be a vector in L{k, N). Then there exists an 
integer b such that 



y^^ai^/a{i) - b 



i=l 



< (|.|+^|a,|/2)l. 



We set N to be large and use a lattice reduction algorithm to find a short 
vector (s, oi, 02, • • • , Ofc) in the lattice L(fc, N). It gives us a constructive upper 
bound. For example, we have found that integers ai, 02, • • • , aioo and t such that 
maxi<i<ioo af(j{i) = 19796 and 



100 



Oi \/a{i) - t 



-115 



which impUes a constructive upper bound i?(19796, 100) < 10 



-115 



1.3 Organization 

In Section ^ we review some relevant facts about lattice and present our algo- 
rithm to find a lower bound for R{a(k),k). In Section [3l we prove a rigorous 
exponential time upper bound exp(0(fc)) for the algorithm and present some 
numerical data. Based on the data we formulate a conjecture which implies that 
our algorithm runs in time 0(poly(fc)). In Section [4l we prove Theorem [TJ In 
Section [HI we prove Theorem [5] and another theorem on a provable upper bound 
for some i?(n, k) where n is much smaller than 2^'^'. Throughout this paper, we 
use lattice functions in Victor Shoup's NTL package to produce numerical data. 
The block size of the BKZ reduction is set to be 10. 



2 Lattices and Our Algorithm 



In the TO-dimensional Euclidean space R™, a (full rank) integral lattice is the 
set 



where bi, b2, • • • bm are linearly independent vectors over R and b^ € Z™ for all 
1 < i < m. The determinant of a lattice is defined to be the absolute value of the 
determinant of the matrix (6y ) where bij is the j-th coordinate of b^ . Assume 
that a lattice has determinant D and the shortest nonzero vector has length A. 
Minkowski's first theorem (see page 12 in [7]) asserts that A < ^JmD^I''^ . 

Finding the shortest nonzero vector in a lattice is a well studied problem. 
The Block-Korkine-Zolotarev (BKZ) lattice reduction algorithm, which is based 
on the famous LLL lattice reduction algorithm, can find a nonzero vector whose 
length is at most 20(™(i'^i"")'/inm);^ -^^ polynomial time [TU]. Although the 
algorithm usually performs better than the worst case approximation ratio, it is 
not believed that a polynomial time algorithm can find nonzero vectors of length 
2o(Viogm)^ for general lattices [6]. See [7] for a survey on computational lattice 
problems. 

To use Theorem [U we need a good lower bound on the length of the short- 
est nonzero vector in L{k,N). We first apply the BKZ reduction algorithm on 
L{k,N) to obtain a reduced base. We then apply the Gram-Schmidt orthogo- 
nalization on the reduced base. Let A* (fc, N) denote the length of the shortest 
Gram-Schmidt vector (we will omit k and N if they are clear from the context). 
Then \*{k, N) is a lower bound for the length of the shortest nonzero vector in 
L{k, N). The main process of our method can be illustrated as follows: 

,j.BKZ , I I I .Gram - Schmidt , ^ ^ ^- 

L(A:,iV) ^ (vo,Vi,--- ,Vfc) ^ (vq, , • • • , vj. 

Note that one should not apply the Gram-Schmidt orthogonalization directly on 
L{k,N). Otherwise the shortest Gram-Schmidt vector will always have length 
1. The algorithm is described as follows. 



Algorithm 1: 

Input: fc, step; 

1. TV = 1; 

2. A* = 0; 

3. while A* < ^'(l -I- fc VoTfc)/2)^ + k^oik) do 

4. iV = AT * step; 

5. Apply the BKZ lattice reduction algorithm on L{k, N); 

6. Apply the Gram-Schmidt orthogonalization on the reduced base; 

7. Let A* be the length of the shortest vector in the Gram-Schmidt base. 

8. endwhile 

9. Output as the lower bound for R{a{k), k). 



3 Time Complexity Analysis and Numerical Data 

Theorem 3. Algorithm 1 runs in time at most exp(0(fc)). 

Proof. Denote the length of the shortest vector in N) by A. Let I be the 
length of the shortest vector in the reduced base. From the proof of Lemma 2.8 
in H, we derive that 

A < ; < 2'^+iA*. 



We shaU prove that if > 2^*"^'", then A > 2^", which implies that for fc > 7 



2k 



A* > 



A 



2fc+i 



> 2 



k~l 



> 3k 



1.5 



On the other hand, we know from formulae ([3]) that for k big enough, cr(fc) < 2k. 
Hence 



(1 + fcv/o^/2)2 + k^a{k) < y (1 + fc\/2fc/2)2 + 2fc3 < ^2^3 + 2fc3 < Sfc^'^ 

This shows that the algorithm will terminate before N exceeds 23*^2*° _ j^-^^ time 
complexity is thus at most O ^A;2'^poly ^fclog23'=2'"^^ , which is exp(0(fc)). 
Assume that N > 2^''^'^ . Any nonzero vector in the lattice has form 



bN,ai,a2, ■ ■ ■ ,ak 



for some integers ai, 02, • • • ,ak and b. It is enough to show that the length of 
the vector is greater than 2^*^. If for some a^, \ai\ > 2^'°, then the length of the 
vector is greater than 2'^''. So we may assume that \ai\ < 2"^^ for all 1 < i < fc. 



- bN 



(^V^ - {nV^}) - bN 



> 



i=l 
k 



> N 



> N 



OiN a{i 

1 

fc 

ai - b 



bN 



1=1 



i=l 
fc 



ai - b 



i=l 



E l"»l 
2 

i=l 

fc22fe 



By the root separation bound, 

fc 



TV 



Qi \/ a(i) — b 



k2 



2k 



> N 2fc J24fea-(fc) 



fc2 



2fc 



which is greater than 2 as TV > 2 



i3fc2" 



The above theorem gives us an exponential upper bound of the time com- 
plexity. However from numerical experiments, we can see that the algorithm 
terminates quickly and enables us to find a lower bound of R{a{k),k) much 
better than the root separation bound. 

We list in Tabled] the values of P and (A*)^ for L(100,7V) where N starts 
from 10^° and keeps increasing by a factor of 10^. From Tabled we learn that 
the square length of the shortest nonzero vector in the lattice L (lOO, lO'^^") is 

greater than 3102794. Since (l + 100^165/2)^ + 100^ * 165 = 2063785.52.., we 
obtain that i?(165, 100) > 10^^^". Similarly we can get the other data on the 
right-hand side in Table [1] 

Table [2] and Table [3] illustrate that the ratio between A* and N'^ remains 
about the same when TV increases. Note that A*(fc, N) is the lower bound of the 
length of the shortest nonzero vector in L{k, N). Based on this observation, we 
formulate the following conjecture on the length of the shortest nonzero vector 
in L{k,N): 

Conjecture 1. The shortest nonzero vector in the lattice L{k,N) has length 
greater than /k. 

Corollary 1. // Conjecturel^is true then 

1. R{a{k),k) > l/(2cr(fc)fc3)^ 

2. Algorithm 1 runs in time 0(poly(fc)). 



Proof. Set 



N 



k((l + k^/^/2y + k^a{k) 



The first item follows from Theorem [T] and Conjecture [TJ The time complexity 
of Algorithm 1 is 0{k ■ poly(fc log A^), which is at most 0(poly(/c)). Thus the 
second item holds. 

It is interesting to contrast L{k, N) with a similar lattice generated by 

(A^,0,0,0,- • • ,0) 
(A^[yi^,l,0,0,--- ,0) 
(A^[Vi^,0,l,0,--- ,0,) 
(7V[yii],0,0,l,--- ,0,) 



{N[^,0,0,0,--- ,1). 



It is easy to see that the shortest vector in the lattice always has length 1 no 
matter how large N is. 



Table 2. The data for L{100,N) (a(lOO) = 165) 
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89063811044 
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0.24 


495 


1.18668E+11 
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0.23 
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1.37029E+11 


4.57E+08 


0.24 


505 


1.79821E+11 


5.16E+08 


0.23 
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2.02652E+11 


7.26E+08 


0.24 
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2.5021E+11 
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520 


4.04579E+11 
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0.24 
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0.24 
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0.22 
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0.22 
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4.13E+09 


0.23 
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1.7404E+12 


5.28E+09 


0.23 
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6.78E+09 


0.23 
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7.92E+09 


0.23 
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3.14243E+12 
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0.24 


575 


4.00544E+12 


1.29E+10 


0.23 


580 
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0.21 
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0.23 
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2.13E+10 


0.21 


595 


1.11703E+13 


2.95E-I-10 


0.22 



Table 3. 



The 



data for X*{k,N)/N 



k 


10 


20 


30 


40 


50 


60 


70 


80 


90 


100 


50 


0.83 


0.74 


0.62 


0.56 


0.48 


0.42 


0.36 


0.29 


0.27 


0.31 


60 


0.91 


0.78 


0.64 


0.57 


0.47 


0.41 


0.34 


0.32 


0.27 


0.23 


70 


0.90 


0.78 


0.65 


0.55 


0.47 


0.39 


0.35 


0.31 


0.29 


0.23 


80 


0.91 


0.77 


0.66 


0.58 


0.50 


0.42 


0.36 


0.33 


0.28 


0.22 


90 


0.90 


0.69 


0.65 


0.58 


0.49 


0.41 


0.37 


0.30 


0.24 


0.23 


100 


0.90 


0.76 


0.65 


0.57 


0.49 


0.43 


0.35 


0.30 


0.28 


0.23 


110 


0.94 


0.73 


0.64 


0.56 


0.46 


0.44 


0.35 


0.32 


0.27 


0.23 


120 


0.75 


0.73 


0.62 


0.59 


0.47 


0.41 


0.34 


0.30 


0.27 


0.22 


130 


0.91 


0.80 


0.63 


0.56 


0.49 


0.42 


0.36 


0.29 


0.27 


0.22 


140 


0.89 


0.78 


0.67 


0.56 


0.51 


0.39 


0.35 


0.31 


0.29 


0.23 


150 


0.89 


0.77 


0.66 


0.53 


0.48 


0.43 


0.35 


0.32 


0.27 


0.22 


160 


0.92 


0.79 


0.64 


0.59 


0.50 


0.39 


0.36 


0.32 


0.25 


0.23 


170 


0.89 


0.75 


0.64 


0.51 


0.47 


0.41 


0.36 


0.31 


0.28 


0.23 


180 


0.92 


0.74 


0.65 


0.58 


0.48 


0.43 


0.36 


0.30 


0.25 


0.22 


190 


0.93 


0.84 


0.65 


0.56 


0.45 


0.38 


0.39 


0.29 


0.26 


0.22 


200 


0.90 


0.78 


0.66 


0.52 


0.47 


0.42 


0.34 


0.32 


0.28 


0.21 


210 


0.83 


0.80 


0.64 


0.56 


0.48 


0.42 


0.40 


0.33 


0.25 


0.23 


220 


0.79 


0.77 


0.67 


0.57 


0.51 


0.44 


0.35 


0.30 


0.28 


0.23 


230 


0.94 


0.73 


0.62 


0.58 


0.44 


0.43 


0.33 


0.30 


0.27 


0.23 


240 


0.91 


0.79 


0.67 


0.58 


0.48 


0.42 


0.36 


0.31 


0.25 


0.23 


250 


0.91 


0.80 


0.63 


0.53 


0.47 


0.41 


0.36 


0.31 


0.26 


0.23 


260 


0.93 


0.77 


0.63 


0.55 


0.47 


0.43 


0.36 


0.33 


0.28 


0.24 


270 


0.91 


0.74 


0.66 


0.54 


0.50 


0.43 


0.39 


0.30 


0.27 


0.23 


280 


0.85 


0.81 


0.63 


0.55 


0.47 


0.42 


0.36 


0.31 


0.26 


0.24 


290 


0.92 


0.79 


0.64 


0.55 


0.49 


0.40 


0.37 


0.32 


0.26 


0.23 


300 


0.94 


0.78 


0.68 


0.57 


0.47 


0.42 


0.34 


0.32 


0.25 


0.23 



4 The Proof of Theorem [T] 



To prove Theorem [1] we need the following lemma. 



Lemma 2. Let si,S2,- ■ • , Sfc he k distinct positive square free integers. Let A 
be the length of the shortest nonzero vector in Lg^ .s^,- - ,Sfc(-^)- For any integers 

ai,a2, ■■■ ,ak,b, if {b, 01,02, • • • , Ofe) 7^ (0, 0, 0, • • • ,0), and - ("^ ^ ^'=2 + 

1 



i=l 



> 



TV' 



Proof. The vector 



^ai[iVys7] - bN,ai,a2, ■ ■■ ,ak\ 

) 



is nonzero and in the lattice, hence its length 



\ i=l \i=l > 



is no smaller than A. Wc have 



Y^a\+[j^a.,{N^-bN\ > A^ > (l + \ 



i=l \i=l 

It implies that 

The left hand side is 
fc 



^a,\N^-bN 



> 



Y,ar[N^~bN 



< 



< 



< 



Y,a^{N^, - {N^,}) ~ bN 

i=l 

k k 

^aiNy/Il-bN + J^^d^Vsl} 

1=1 i=i 

k fc 



i=l 
fc 



1=1 



So we have 



therefore 



J2 aiN^, - bN 



> 1, 



Eti - ^1 > 1/^- 

Now we are ready to prove Theorem [TJ 

Proof. Let rii.l < i < k he positive integers < cr{k), m be an integer and et S 
{1, 0, —1} for aU 1 < j < fc. We can write ^i\f^i ~ m as — b 

where ai, 02, • • • , a^, 6 are integers. We have that 



and 

k / k \ 2 

i=l \i=l / 

Assume that (ai, 02, • • • , a^:, 6) 7^ (0, 0, • • • , 0, 0). Since the shortest nonzero vec- 
tor in the lattice L{k, N) has length at least 

2 i. 



1 + A: ' + fcV(fc) > ( 1 + 



we conclude from Lemma [2] that, 

k 



> 



TV 



5 Upper Bound 

Now we can prove Theorem [51 

Proof. Since (s, ai, a2, ■ • ■ , ak) is a vector in the lattice L(k, N), there exists an 

k 



integer 6 such that 



Then 



i=l 



i=l 



- bN 



^a, ([iVy^] +{N^/^^^^bN 



< 



i=l 
k 



k 

<\s\ + Y,\a,\/2. 

i=l 



Hence the theorem foUows. 



We may apply the BKZ reduction algorithm on the lattice and obtain a 
nonzero vector (s, 01,03, • • • ,0^) of length at most 2C('=(i"i"'=)'/i'i'=)iV^. The 
data is listed in Table [H More generally, we have 

Theorem 4. Let si, S2, • ■ ■ , Sk be k distinct square free integers no smaller than 
2 . For any integer N , we can find integers Oi , 02 , • • ■ , a/j and b in polynomial time 
satisfying that \ai\ < 20('=(ininfc)Vin4iV^ for all 1 < i < k and 



k 
i=l 



< 



20(k{\n\nk)^ / \nk) 



fc+1 



Proof. The determinant of the lattice L{k, N) is 



N 00 ••• 
[N^] 1 • • • 
[Ny/I^] 1 • • • 
[N^] 1 • • • 



[N^ 



1 



= N 



By Minkowski's first theorem, there is a vector of length \/k + IN ''+^ or shorter 
in the lattice. If we apply the BKZ reduction algorithm on the lattice, we obtain a 
nonzero vector (s, ai, 02, • • • , a^) of length at most 2'-'('=(^"^"'=) /infc) jy^qrT_ xhus 
\ai\ < 20('=(i'i In fc) foj. all 1 < i < fc and \s\ < 2o(*=(inin/c)Vinfe)^,^_ 
We have 



< 



k + l 



6 Concluding Remarks 

In this paper we present a numerical method that finds a much better lower 
bound for R{n, k) than the previously known methods do. The main open prob- 
lem is to prove Conjecture [l] which implies that our method runs in polynomial 
time. 
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Table 4. The data for the shortest vector in the BKZ reduced base: n = 
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